Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[patch] acme.sh --showcsr fails when Subject has no content (Subject= followed by nothing) #4024

Open
ZjYwMj opened this issue Apr 9, 2022 · 2 comments
Open

[patch] acme.sh --showcsr fails when Subject has no content (Subject= followed by nothing) #4024

ZjYwMj opened this issue Apr 9, 2022 · 2 comments

Comments

@ZjYwMj
Copy link

ZjYwMj commented Apr 9, 2022

Steps to reproduce

  1. Have a csr with an empty subject, but otherwise valid. That is,
$ openssl req -in myCsr.csr -noout -subject  
subject=

letsencrypt seem to accept such a csr. Perhaps when it has a subjectAltName.
One way to generate such a csr is

openssl req -new -sha256 -key myDomain.key -subj "/" \
        -reqexts SAN -config <(cat /etc/ssl/openssl.cnf \
       <(printf "\n[SAN]\nsubjectAltName=DNS:foo.com,DNS:www.foo.com"))
  1. Download, but do not configure, or install, acme.sh.
  2. Asuming it was downloaded to the current directory,
$ acme.sh --showcsr --csr myCsr.csr
[Sat Apr  9 09:05:28 PM UTC 2022] Can not read subject from csr: myCsr.csr

Debug log

$ acme.sh --showcsr --csr myCsr.csr --debug 4  |& tail -1
[Sat Apr  9 09:23:45 PM UTC 2022] Can not read subject from csr: myCsr.csr

Patch

A patch is included below.

  1. The patch is against v3.0.3.
  2. The patch is only verified to fix what is shown above, in the Steps to reproduce section. No other tests were done. Testing was extremely superficial. In particular, no cert issuing, or renewal, were tried with the patched version.
--- a/acme.sh	2022-04-09 20:18:45.701924233 +0000
+++ b/acme.sh	2022-04-09 21:28:48.079668099 +0000
@@ -5513,7 +5513,7 @@
   _initpath
 
   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
-  if [ "$?" != "0" ] || [ -z "$_csrsubj" ]; then
+  if [ "$?" != "0" ]; then
     _err "Can not read subject from csr: $_csrfile"
     return 1
   fi
@Neilpang
Copy link
Member

please give me your CSR.

@ZjYwMj
Copy link
Author

ZjYwMj commented Apr 10, 2022 via email •
edited

Neilpang added a commit that referenced this issue Apr 20, 2022
@Neilpang
read csr with empty subject
4d89ce5 
#4024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@Neilpang @ZjYwMj